A heap-based buffer overflow in the Windows TCP/IP stack lets an unauthenticated, adjacent-network attacker elevate privileges, earning a CRITICAL CVSS score of 9.6.
What Is It
CVE-2026-42904 is a heap-based buffer overflow (CWE-122) in Windows TCP/IP. According to Microsoft, the flaw "allows an unauthorized attacker to elevate privileges over an adjacent network." It was published on June 9, 2026, and currently carries an NVD status of "Awaiting Analysis."
Why It Matters
Microsoft rates this vulnerability CRITICAL with a CVSS 3.1 base score of 9.6. The vector (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) reflects why it is so dangerous:
- No authentication or user interaction required (PR:N, UI:N), an attacker needs no credentials and no victim action.
- Low attack complexity (AC:L), the flaw is straightforward to exploit.
- Scope is changed (S:C), exploitation can affect components beyond the vulnerable one.
- High impact across confidentiality, integrity, and availability (C:H/I:H/A:H), a successful attack can fully compromise the target.
Because it sits in the core TCP/IP stack, the attack surface is broad across affected Windows systems on the same network segment.
What's Vulnerable
The vulnerability lies in Windows TCP/IP. The attack vector is ADJACENT_NETWORK, meaning an attacker must be on the same logical network (for example, the same subnet or broadcast domain) rather than exploiting it across the open internet. The supplied NVD record lists no specific affected product versions (CPEs).
Patch Status
No CISA KEV entry was supplied for this CVE, so there is no confirmation of active exploitation in the provided source material. Microsoft has published a vulnerability entry in its Security Update Guide; administrators should consult the MSRC update guide below for patch and remediation details.